52 Scientific American, June 2016

sad0616Shla3p.indd 52

4/20/16 6:21 PM

THE
TRUTH
ABOUT
SELFDRIVING
CARS
T R A N S P O R TAT I O N

*****************************************
*****************************************
*****************************************
* * * * * * * * * * * *A*I * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * * * * * * *S*P*E*C*I*A*L* * * * * * * * * * * * * * * * * * * * * * * * * *
*****************************************
* * * * * * * * * R* E* P* O
*****************************
* * * * * * * * * * * * * *R*T* * * * * * * * * * * * * * * * * * * * * * * * * *
*****************************************
*****************************************
*****************************************

They are coming, but not the way

you may have been led to think
By Steven E. Shladover

June 2016, ScientificAmerican.com 53

sad0616Shla3p.indd 53

4/20/16 6:21 PM

Steven E. Shladover helped to create the California Partners

for Advanced Transportation Technology (PATH) program at the
Institute of Transportation Studies at the University of California,
Berkeley, in the 1980s. He is a mechanical engineer by training,
with bachelors, masters and doctoral degrees from the
Massachusetts Institute of Technology.

OON ELECTRONIC CHAUFFEURS WILL TAKE US WHEREVER WE WANT

to go, whenever we want, in complete safetyas long as
we do not need to make any left turns across traffic. Changing road surfaces are a problem, too. So are snow and ice.
It will be crucial to avoid traffic cops, crossing guards and
emergency vehicles. And in an urban environment where
pedestrians are likely to run out in front of the car, we
should probably just walk or take the subway.

All these simple, everyday encounters for human drivers pose

enormous problems for computers that will take time, money
and effort to solve. Yet much of the public is becoming convinced
that fully automated vehicles are just around the corner.
What created this disconnect? Part of the problem is terminology. The popular media applies the descriptors autonomous, driverless and self-driving indiscriminately to technologies that are very different from one another, blurring
important distinctions. And the automotive industry has not
helped clarify matters. Marketers working for vehicle manufacturers, equipment suppliers and technology companies carefully compose publicity materials to support a wide range of interpretations about the amount of driving their products automate. Journalists who cover the field have an incentive to adopt
the most optimistic forecaststhey are simply more exciting.
The result of this feedback loop is a spiral of increasingly unrealistic expectations.
This confusion is unfortunate because automated driving is

coming, and it could save lives, reduce pollution and conserve

fuel. But it will not happen in quite the way you have been told.
DEFINING AUTOMATED DRIVING

DRIVING IS A MUCH MORE COMPLEX ACTIVITY than most people appreciate. It involves a broad range of skills and actions, some of
which are easier to automate than others. Maintaining speed on
an open road is simple, which is why conventional cruise-control systems have been doing it automatically for decades. As
technology has advanced, engineers have been able to automate
additional driving subtasks. Widely available adaptive cruisecontrol systems now maintain proper speed and spacing behind
other vehicles. Lane-keeping systems, such as those in new
models from Mercedes-Benz and Infiniti, use cameras, sensors
and steering control to keep a vehicle centered in its lane. Cars
are pretty smart these days. Yet it is an enormous leap from such
systems to fully automated driving.
A five-level taxonomy defined by SAE International (formerly

IN BRIEF

The auto industry and the press have oversold the

automated car. Simple road encounters pose huge
challenges for computers, and robotic chaueurs remain decades away.

Automated driving systems that rely on humans for

backup are particularly problematic. Yet in the next
decade we will see automatic-driving systems that are
limited to specic conditions and applications.

Automatic parking valets, low-speed campus shuttles, closely spaced platoons of heavy trucks and automatic freeway-control systems for use in dedicated
lanes are all feasible and perhaps inevitable.

54 Scientific American, June 2016

sad0616Shla3p.indd 54

4/20/16 5:30 PM

SOURCE: SAE INTERNATIONAL (WWW.SAE.ORG/MISC/PDFS/AUTOMATED_DRIVING.PDF); FOR DOCUMENTATION, INCLUDING ORIGINAL DEFINITIONS

IN THEIR ENTIRETY, SEE TAXONOMY AND DEFINITIONS FOR TERMS RELATED TO ON-ROAD MOTOR VEHICLE AUTOMATED DRIVING SYSTEMS.
SAE INTERNATIONAL, JANUARY 2014

*****************************

TA XO N O M Y

The Ladder of Automation

The automotive industry and the media have made a mess of the
terminology used to talk about automated driverless systems. The
terms autonomous, driverless and self-driving obscure more
than they illuminate. To clear things up, SAE International wrote
denitions, paraphrased here, for dierent levels of automation and

arranged them on a ladder of decreasing reliance on the driver.

The hierarchy reveals some surprises. For example, level-four automation is potentially more tractable than level three. Level-ve
automated systemselectronic chaueurs that can handle any
driving condition with no human inputare decades away.

Human Driver Monitors Environment

Who steers,
accelerates
and
decelerates

System Monitors Environment

No
Automation

Driver
Assistance

Partial
Automation

Conditional
Automation

High
Automation

Full
Automation

The absence of any

assistive features
such as adaptive
cruise control.

Systems that help

drivers maintain
speed or stay in
lane but leave the
driver in control.

The combination
of automatic speed
and steering controlfor example,
cruise control and
lane keeping.

Automated systems that drive and

monitor the environment but rely
on a human driver
for backup.

Automated systems
that do everythingno human
backup required
but only in limited
circumstances.

The true electronic

chaueur: retains
full vehicle control,
needs no human
backup and drives
in all conditions.

Human driver

Human driver
and system

System

System

System

System

Human driver

Human driver

Human driver

System

System

System

Human driver

Human driver

Human driver

Human driver

System

System

None

Some driving
modes

Some driving
modes

Some driving
modes

Some driving
modes

All driving modes

SOURCE: SAE INTERNATIONAL (WWW.SAE.ORG/MISC/PDFS/AUTOMATED_DRIVING.PDF); FOR DOCUMENTATION, INCLUDING ORIGINAL DEFINITIONS

IN THEIR ENTIRETY, SEE TAXONOMY AND DEFINITIONS FOR TERMS RELATED TO ON-ROAD MOTOR VEHICLE AUTOMATED DRIVING SYSTEMS.
SAE INTERNATIONAL, JANUARY 2014

Who monitors
the driving
environment

Who takes
control when
something
goes wrong

How much
driving,
overall, is
assisted or
automated

the Society of Automotive Engineers) is useful for clarifying our

thinking about automated driving. The first three rungs on this
ladder of increasing automation (excluding level zero, for no automation) are occupied by technologies that rely on humans for
emergency backup. Adaptive cruise control, lane-keeping systems,
and the like belong to level one. Level-two systems combine the
functions of level-one technologiesthe lateral and longitudinal

Illustrations by Nigel Holmes (icons)

sad0616Shla3p.indd 55

controls of lane-keeping and adaptive cruise-control systems, for

exampleto automate more complex driving tasks. This is as far
as commercially available vehicle automation goes today. Levelthree systems would allow drivers to turn on autopilot in specific
scenarios, such as freeway traffic jams.
The next two levels are profoundly different in that they operate entirely without human assistance. Level-four (high-auto-

June 2016, ScientificAmerican.com 55

4/20/16 5:30 PM

mation) systems would handle all driving subtasks,

but they would operate only in strictly defined scenariosin enclosed parking garages, for example,
or in dedicated lanes on the freeway. At the top of
the ladder is level fivethe fully automated car. Presumably, this is what many people have in mind
when they hear someone such as Nissan CEO Carlos
Ghosn confidently proclaim that automated cars
will be on the road by 2020.
The truth is that no one expects level-five automation systems to be on the market by then. In all likelihood, they are a long way off. Level-three systems
might be just as remote. But level four? Look for it
within the next decade. To understand this confusing
state of affairs, we have to talk about software.
SOFTWARE NIGHTMARE

NEXT YEAR Volvo Cars will field-test 100 vehicles equipped with
systems that automate driving on special stretches of freeway (1 and
2). Volvos have also been used in European road-train tests (3).

magnitude more complex than what it takes to fly an airplane.

Once the code is validated, manufacturers will need ways to
prove the safety of a complete automated driving system to
the satisfaction of company risk-management officers, insurance firms, safety advocates, regulators and, of course, potential
customers. The kind of formal acceptance tests used today are
completely impractical for this purpose. Testers would have to
put hundreds of millions, if not billions, of miles on a vehicle to
ensure that they have subjected it in a statistically significant
way to the dangerous scenarios it will encounter when it is regularly used by thousands of customers. People have started to
think about solutions to this problemthe German government
and industry have launched a multimillion-dollar project with
that goalbut those efforts have just begun.
The code that will control the vehiclethe brain, so to speak
is not the only thing that must be subjected to scrutiny. The sensors that provide that brain with the data it will use to make de
cisions must be subjected to equal scrutiny. Engineers must de
velop new sensor-signal processing and data-fusion algorithms
that can discriminate between benign and hazardous objects in a
vehicles path with nearly zero false negatives (hazardous objects

COURTESY OF VOLVO CAR GROUP (13)

1
Despite the popular perception, h
 uman drivers are re
markably capable of avoiding serious crashes. Based
on the total U.S. traffic safety statistics for 2011, fatal crashes
occurred about once for every 3.3million hours of driving; crashes that resulted in injury happened approximately once for every
64,000 hours of driving. These numbers set an important safety
target for automated driving systems, which should, at minimum, be no less safe than human drivers. Reaching this level of
reliability will require vastly more development than automation
enthusiasts want to admit.
Think about how often your laptop freezes up. If that software
were responsible for driving a car, the blue screen of death
would become more than a figure of speech. A delayed software
response of as little as one tenth of a second is likely to be hazardous in traffic. Software for automated driving must therefore be
designed and developed to dramatically different standards from
anything currently found in consumer devices.
Achieving these standards will be profoundly difficult and re
quire basic breakthroughs in software engineering and signal processing. Engineers need new methods for designing software that
can be proved correct and safe even in complex and rapidly changing conditions. Formal methods for analyzing every possible failure mode for a piece of code before it is written existthink of
them as mathematical proofs for computer programsbut only
for very simple applications. Scientists are only beginning to think
about how to scale up these kinds of tests to validate the incredibly complex code required to control a fully automated vehicle.
Once that code has been written, software engineers will need
new methods for debugging and verifying it. Existing methods
are too cumbersome and costly for the job. To put this in perspective, consider that half of the cost of a new commercial or military
aircraft goes toward software verification and validation. The
software on aircraft is actually much less c omplex than what will
be needed for automated road vehicles. An engineer can design
an aircraft autopilot system knowing that it will rarely, if ever,
have to deal with more than one or two other aircraft in its vicinity. It does not need to know the velocity and location of those aircraft with incredible precision, because they are far enough apart
that they have time to act. Decisions must be made on the order
of tens of seconds. An automated road vehicle will have to track
dozens of other vehicles and obstacles and make decisions within fractions of a second. The code required will be orders of

SCIENTIFIC AMERICAN ONLINE To watch a talk by Shladover, go to ScientificAmerican.com/jun2016/cars

sad0616Shla3p.indd 56

4/20/16 5:30 PM

that were not identified) and extremely low false positives (be
nign objects that were misclassified, leading to inappropriate re
sponses from vehicles, such as swerving or hard braking).
Engineers cannot resort to the kind of brute-force redundan
cy used in commercial aircraft systems to achieve these goals be
cause an automated car is a consumer product: it must be af
fordable for the general public. Turning to artificial intelligence
is not an obvious solution, either. Some people have suggested
that machine-learning systems could enable automated driving
systems to study millions of hours of driving data and then learn
throughout the course of their life cycle. But machine learning
introduces its own problems because it is nondeterministic.
Two identical vehicles can roll off the assembly line, but after a
year of encountering different traffic situations, their automa
tion systems will behave very differently.
LEVEL-FOUR FUTURE

I used to tell people that level-five fully automated driving sys

tems would not become feasible until after 2040. Somewhere
along the way people started quoting me as saying level five
would arrive i n 2040. Now I say that fully automated vehicles
capable of driving in every situation will not be here until 2075.
Could it happen sooner than that? Certainly. But not by much.
The prospects for level-three automation are clouded, too,
because of the very real problem of recapturing the attention, in
an emergency, of a driver who has zoned out while watching the
scenery go by or, worse, who has fallen asleep. I have heard repre
sentatives from some automakers say that this is such a hard prob
lem that they simply will not attempt level three. Outside of trafficjam assistants that take over in stop-and-go traffic, where speeds
are so low that a worst-case collision would be a fender bender, it
is conceivable that level-three automation will never happen.
And yet we will see highly automated cars soon, probably
within the coming decade. Nearly every big automaker and many
information technology companies are devoting serious resourc
es to level-four automation: fully automated driving, restricted to
specific environments, that does not rely on a fallible human for
backup. When you limit the situations in which automated vehi
cle systems must operate, you greatly increase their feasibility.
(Automated people movers have been operating in big airports
for yearsbut they are on totally segregated tracks.)
In all probability, the next 10 years will bring automated
valet-parking systems that will allow drivers to drop their cars at

the entrance of a suitably equipped garage that excludes pedes

trians and nonautomated vehicles. An onboard automation sys
tem will communicate with sensors placed throughout the
garage to find out which parking spots are available and navigate
to them. Because there will be no need to open the doors, park
ing spaces can be narrower than they are today, so more cars will
be able to fit in garages in areas where space is expensive.
In urban pedestrian zones, business parks, university cam
puses and other places where high-speed vehicles can be ex
cluded, low-speed passenger shuttles will operate without driv
ers. In such environments, limited-capability sensors should be
adequate to detect pedestrians and bicyclists, and if a sensor
detects a false positive and brakes unnecessarily, it will not
harm anyone (although it will annoy the people in the vehicle).
The CityMobil2 project of the European Commission has been
demonstrating such technologies for several years, and its final
demonstration is scheduled for this summer.
Segregated bus ways and truck-only lanes will soon enable com
mercial vehicles to operate at higher levels of automation. Physical
ly segregating these vehicles from other users will greatly simplify
threat detection and response systems. Eventually driverless trucks
and buses will be able to follow a human-driven lead vehicle in fuelsaving platoons. Researchers worldwide, including the California
Partners for Advanced Transportation Technology (PATH) pro
gram at the University of California, Berkeley, Japans Energy ITS
project, and the KONVOI and SARTRE projects in Europe, have
already tested prototype bus- and truck-platoon systems.
Yet the most widespread implementation of level-four automa
tion within the next decade will probably be automated freeway
systems for personal passenger vehicles. These systems will per
mit automobiles to drive themselves under certain conditions on
designated sections of freeway. The vehicles will have redundant
components and subsystems so that if something goes wrong,
they can limp home without human guidance. They will proba
bly be restricted to fair weather on stretches of freeway that have
been mapped in detail, down to the signage and lane markings.
These sections of road might even have safe harbor locations
where vehicles can go when they have problems. Most major vehi
cle manufacturers are hard at work developing these systems, and
next year Volvo Cars plans to conduct a public field test of such
capabilities with 100 prototype vehicles in Gothenburg, Sweden.
These scenarios might not sound as futuristic as having your
own personal electronic chauffeur, but they have the benefit of
being possibleeven inevitableand soon.

M O R E TO E X P L O R E

Technical Challenges for Fully Automated Driving Systems. Steven Shladover.

Presented at the 21st World Congress on Intelligent Transport Systems, Detroit,
Mich., September 711, 2014.
Towards Road Transport Automation: Opportunities in Public-Private Collaboration.
Summary of the Third EU-U.S. Transportation Research Symposium, Washington, D.C.,
April 1415, 2015. National Academies of Sciences, Engineering, and Medicine, 2015.
Summary of definitions for SAE Internationals 2014 report Taxonomy and Definitions
for Terms Related to On-Road Motor Vehicle Automated Driving Systems: 
www.sae.org/misc/pdfs/automated_driving.pdf
FROM OUR ARCHIVES

Driving toward Crashless Cars. S teven Ashley; December 2008.

s c i e n t i f i c a m e r i c a n . c o m /m a g a z i n e /s a

June 2016, ScientificAmerican.com57

sad0616Shla3p.indd 57

4/20/16 5:30 PM